components/kubemacpool: Add monitoring objects

Upstream kubemacpool added monitoring infrastructure [0][1][2].
- Adding the added objects, with configurable params that will be
rendered on runtime by CNAO.
- wrapping these objects by another param MonitoringAvailable that will
be also rendered on realtime, so these objects will be deployed only
then prometheus is installed on the cluster.

[0] k8snetworkplumbingwg/kubemacpool#596
[1] k8snetworkplumbingwg/kubemacpool#587
[2] k8snetworkplumbingwg/kubemacpool#598

Assited-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Ram Lavi <ralavi@redhat.com>

Author: RamLavi

data/kubemacpool/kubemacpool-monitoring.yaml

@@ -0,0 +1,91 @@
+{{ if .MonitoringAvailable }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: kubemacpool-prometheus
+  namespace: '{{ .Namespace }}'
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - services
+  - endpoints
+  - pods
+  verbs:
+  - get
+  - list
+  - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: kubemacpool-prometheus
+  namespace: '{{ .Namespace }}'
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: kubemacpool-prometheus
+subjects:
+- kind: ServiceAccount
+  name: '{{ .MonitoringServiceAccount }}'
+  namespace: '{{ .MonitoringNamespace }}'
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    control-plane: mac-controller-manager
+    prometheus.kubemacpool.io: "true"
+  name: kubemacpool-metrics-service
+  namespace: '{{ .Namespace }}'
+spec:
+  ports:
+  - name: metrics
+    port: 8443
+    protocol: TCP
+    targetPort: 8443
+  selector:
+    control-plane: mac-controller-manager
+---
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  labels:
+    openshift.io/prometheus-rule-evaluation-scope: leaf-prometheus
+    prometheus.kubemacpool.io: "true"
+  name: kubemacpool-prometheus-rule
+  namespace: '{{ .Namespace }}'
+spec:
+  groups:
+  - name: alerts.rules
+    rules:
+    - alert: KubemacpoolMACCollisionDetected
+      annotations:
+        description: '{{ "{{" }} $value {{ "}}" }} MAC address(es) have collisions. Multiple running
+          objects are using the same MAC address.'
+        summary: MAC address collisions detected.
+      expr: count(kmp_mac_collisions > 1) > 0
+      for: 30s
+      labels:
+        operator_health_impact: warning
+        severity: warning
+---
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  labels:
+    openshift.io/cluster-monitoring: "true"
+    prometheus.kubemacpool.io: "true"
+  name: kubemacpool-metrics-monitor
+  namespace: '{{ .Namespace }}'
+spec:
+  endpoints:
+  - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
+    port: metrics
+    scheme: https
+    tlsConfig:
+      insecureSkipVerify: true
+  selector:
+    matchLabels:
+      control-plane: mac-controller-manager
+{{ end }}

hack/components/bump-kubemacpool.sh

@@ -22,6 +22,7 @@ echo 'Configure kustomize for CNAO templates and save the rendered manifest unde
 (
     cd ${KUBEMACPOOL_PATH}
     mkdir -p config/cnao
+    mkdir -p config/cnao-monitoring
 
     cat <<EOF > config/cnao/kustomization.yaml
 apiVersion: kustomize.config.k8s.io/v1beta1
@@ -65,6 +66,14 @@ patches:
     kind: Deployment
 EOF
 
+    cat <<EOF > config/cnao-monitoring/kustomization.yaml
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: "{{ .Namespace }}"
+bases:
+- ../monitoring
+EOF
+
     cat <<EOF > config/cnao/cnao_kubemacpool_manager_patch.yaml
 apiVersion: apps/v1
 kind: Deployment
@@ -177,6 +186,15 @@ rm kustomize.tar.gz
     ./kustomize build config/cnao | sed "s/'{{ toYaml \(.*\)}}'/{{ toYaml \1}}/;s/'{{ .RunAsNonRoot }}'/{{ .RunAsNonRoot }}/g;s/'{{ .RunAsUser }}'/{{ .RunAsUser }}/g"
 ) > data/kubemacpool/kubemacpool.yaml
 
+(
+    cd $KUBEMACPOOL_PATH
+    echo '{{ if .MonitoringAvailable }}'
+    ./kustomize build config/cnao-monitoring | sed "s/'{{ toYaml \(.*\)}}'/{{ toYaml \1}}/;s/'{{ .RunAsNonRoot }}'/{{ .RunAsNonRoot }}/g;s/'{{ .RunAsUser }}'/{{ .RunAsUser }}/g" \
+        | sed "s/  name: prometheus-k8s$/  name: '{{ .MonitoringServiceAccount }}'/;s/  namespace: monitoring$/  namespace: '{{ .MonitoringNamespace }}'/" \
+        | sed 's/{{ \$value }}/{{ "{{" }} \$value {{ "}}" }}/g'
+    echo '{{ end }}'
+) > data/kubemacpool/kubemacpool-monitoring.yaml
+
 echo 'Get kubemacpool image name and update it under CNAO'
 KUBEMACPOOL_TAG=$(git-utils::get_component_tag ${KUBEMACPOOL_PATH})
 KUBEMACPOOL_IMAGE=quay.io/kubevirt/kubemacpool